High-Severity Duc Disk Tool Flaw (CVE-2025-13654) Risks DoS and Information Leak via Integer Underflow

According to CERT Coordination Center (CERT/CC), a stack-based buffer overflow in Duc, a Linux disk usage indexing tool, has been disclosed as CVE-2025-13654. The flaw resides in the core Duc library, within the buffer_get function in buffer.c, and is caused by an unsigned subtraction that can wrap on crafted input, leading to an out-of-bounds read by memcpy.

The advisory notes that an attacker supplying malformed data to Duc could trigger a crash or information leak, potentially allowing DoS and information disclosure by exposing adjacent stack data. The vulnerability is particularly risky in enterprise environments where disk indexing tools are automated or exposed to external input, though Duc is primarily a local administrative tool.

The vulnerability was reported by security researcher Hacking ByDoing, and maintainers have released a fix with Duc 1.4.6 as the corrected version; administrators and users are urged to upgrade immediately, with the patch available on the project’s GitHub repository for mitigation.